Risk Materialized??? Controls Untested!!!!

Written by Steven Randall, Partner, Vonya Global

In the video clip above a woman is walking up Michigan Avenue in Chicago. Why she decided to ignore the sidewalk and walk up the middle of the street is anyone’s guess. The video only captured a small portion of her solo parade which actually lasted for many blocks. It is obvious to me that no one has ever had a conversation with this woman about value of sidewalks.

In a business sense, a sidewalk is essentially an internal control. Prior to the invention of sidewalks, there was a risk of pedestrians getting trampled by moving vehicles. Sidewalks are designed to separate people and vehicles, thereby mitigating that risk. However, as in the case of this video, having designed an internal control is not enough to guarantee the risk is mitigated.

Designing Internal Controls

Businesses have hundreds of internal control mechanisms in place to mitigate various risks. When designed and operating properly, the internal control systems work very well preventing adverse events (risks). However, all it takes is one creative person (or lunatic as in this video) to figure out a way to circumvent the system of internal controls. Whether malicious or not, the results of internal control circumvention is usually chaos and havoc. You may hear someone say:

“Yes, we have a policy and procedure for that, but it takes too long. We do it a different way to save time.”

Testing Internal Controls

It is not enough to design the internal control mechanisms. The only way to validate that the control is working as designed is to test the internal control effectiveness. Questions that should be asked include:

  • What risk is being controlled?
  • Do the controls work as designed?
  • Can the controls be circumvented (and/or are they)?
  • Have changes in the business changed the need for the control?
  • Is there other cost-effective solutions?

Most people do not anticipate that adverse events will impact their business – just the same as most people would not anticipate someone walking up the middle of Michigan Avenue. The businesses that avoid catastrophe are those that continually assess risk, evaluate internal control design, and test internal control effectiveness. These companies have access to internal auditors, like those at Vonya Global, who have the skills and experience to evaluate the entire business.

This blog post was authored by Steven Randall. Steve is a Managing Partner with Vonya Global, a premier provider of internal audit co-sourcing, outsourcing, and consulting services; a member of the Institute of Internal Auditors (IIA) Chicago Chapter Board of Governors; a Director of the Adler-Caris Foundation, a not-for-profit dedicated to raising funds for Alzheimer’s Disease research; the President of the Oz Park Baseball Association, a not-for-profit organization dedicated to providing fundamental based baseball in a safe environment in the city of Chicago; and an Advisory Board Member of the Chicago Youth Baseball Initiative, a University of Illinois at Chicago community group dedicated to providing Chicago youth with the opportunity to play baseball in a fun and safe environment, while offering educational experiences on a world-class college campus. If you would like more information about Vonya Global or if you have a question for Steve, you may contact him through this blog, the company website, twitter, or his LinkedIn Profile.